The vulnerability is in the installation security component of Oracle JD Edwards EnterpriseOne Tools. It is a difficult‑to‑exploit flaw that allows an unauthenticated attacker with access to the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools runs to compromise the tool. If successfully exploited, the attacker can fully takeover the system, compromising confidentiality, integrity, and availability. The CVSS 3.1 Base Score of 7.5 reflects high impact across all three properties.

The affected product is Oracle Corporation’s JD Edwards EnterpriseOne Tools. Versions from 9.2.0.0 through 9.2.26.5 are vulnerable.

The CVSS score of 7.5 indicates substantial risk, and the EPSS score of < 1% suggests low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. The attack vector requires adjacent network access combined with physical access to the device’s communication segment; this limits exposure primarily to insiders or those with physical proximity. Nevertheless, a successful breach would allow complete takeover of the JD Edwards EnterpriseOne Tools environment.